Legal Framework Applicable in Portugal

The Legal Framework of Credit Institutions and Financial Companies (Decree-Law No 268/92, of 31 December) contains the main rules for Portugal’s banking sector, specifically for the activity of credit institutions and financial companies. It covers authorisation, registration, management and shareholder assessment, conduct rules, co-operation with authorities, prudential limits, supervision, corrective measures, deposit guarantees, and penalties. The principal European texts are transposed in Portugal and are included either in the Legal Framework of Credit Institutions and Financial Companies or in secondary, supplement laws and regulations.

The provision of investment services by a Portuguese institution is subject to the Portuguese Securities Code (Decree-Law No 486/99, of 13 November), which incorporates the rules of MiFID II (Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014).

As regards payment services and electronic money, Portuguese credit institutions and financial companies must comply with the Legal Framework for Payment Services and Electronic Money, which incorporates PSD2 (Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015).

The Portuguese Anti-Money Laundering and Counter-Terrorist Financing Law (Law No 83/2017, of 18 August) is also a key piece of legislation in Portugal, applicable to the banking sector.

EU regulations are directly applicable in Portugal, such as the Capital Requirements Regulation (CRR) – Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013) and the Digital Operational Resilience Act (DORA) – Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector), among others.

Banco de Portugal (the Portuguese Central Bank) establishes national requirements in its Notices, Instructions, and understandings. The guidelines and Q&As issued by the European Central Bank (ECB) and by the European Supervisory Authorities are also usually adopted in Portugal, by Banco de Portugal. 

Supervision Authorities

Under Portuguese law, supervision is divided between Banco de Portugal, the national competent authority, which is responsible for supervising banking activities in Portugal (including credit institutions and financial companies’ compliance with the anti-money laundering and counter-terrorist financing requirements), and the ECB, whose supervision enforces European legislation (namely, the Single Supervisory Mechanism (SSM) – Council Regulation (EU) No 1024/2013 of 15 October 2023, and the SSM Framework Regulation – Regulation (EU) No 468/2014 of the ECB of 16 April 2014). 

The Portuguese Securities Market Commission (Comissão do Mercado de Valores Mobiliários – CMVM) supervises the provision of investment services and the activity in capital markets, generally.

Authorisation and Activities

Authorisation to initiate banking activities in Portugal can be obtained through a request to incorporate a credit institution or a financing company, both defined in the Legal Framework of Credit Institutions and Financial Companies.

Credit institutions cover several types of entities, the main type being banks. In Portugal, banks enjoy universal banking licence and are entitled to carry out operations such as: (i) acceptance of deposits or other repayable funds; (ii) credit operations, including the granting of guarantees and other commitments, financial leasing, and factoring; (iii) payment services; (iv) transactions, on their own account or on behalf of clients, involving money market and foreign exchange market instruments, financial futures instruments, options, and operations on currencies, interest rates, commodities, and securities; (v) advisory services, custody, administration, and management of securities portfolios; (vi) management and consultancy in the management of other assets; and (vii) provision of investment services and activities, among others.

Only credit institutions are allowed to receive deposits or other repayable funds from the public for use on their own account.

Licence Process

In Portugal, the process for obtaining a banking licence involves three key stages: (i) securing authorisation (which includes submission of the application along with supporting documentation, evaluation of the application, and the final decision on authorisation); (ii) completing special registration with the Banco de Portugal; and (iii) initiating operations.

The process to set up a credit institution formally starts with the submission of the respective application, either in Portuguese or in English, physically or via e-mail, to Banco de Portugal. No fee is due to the Banco de Portugal during this process.

Following receipt of the application, Banco de Portugal, together with the ECB, reviews the information submitted to ensure that it is complete and sufficient for a comprehensive evaluation. The purpose of this review is to determine whether the proposed project fulfils all the conditions required by applicable legislation.

A final decision (granting or refusing the authorisation) is issued within six months from Banco de Portugal receiving a complete application or the additional information that may be requested, or within a maximum of 12 months of the initial application submission. The absence of notification of a decision by Banco de Portugal represents a tacit refusal of the application.

The granting of authorisation enables the applicant to set up a credit institution, which must start its activities within 12 months of the approval decision (otherwise, the authorisation expires), without prejudice of a one-time extension for another 12 months, as provided.

To commence banking activities, the credit institution must also have completed a special registration with Banco de Portugal.

Common Ancillary Activities and Additional Requirements

It is typical for Portuguese credit institutions to carry out investment services and activities, including, among other ancillary services: (i) reception and transmission of orders on behalf of others; (ii) execution of orders on behalf of others; (iii) portfolio management on behalf of others; (iii) services and activities involving underwriting and placement with a guarantee, or placement without a guarantee; (iv) trading on own account; (v) investment advice; (vi) management of a multilateral trading facility; and (vii) management of an organised trading facility.

In Portugal, in addition to authorisation by Banco de Portugal, registration with the Portuguese Securities Market Commission is required for financial intermediation activities. This additional registration is a case of gold-plating, making the process more time-consuming.

Furthermore, in relation to the issuance, offer to the public, and admission to trading of crypto-assets or the provision of services related to crypto-assets, credit institutions shall observe the requirements established by MiCA (Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023), notably the required notification.

European Passport

European Union credit institutions – passport

To commence activities in Portugal, a notification from the home member state’s competent authority to the Banco de Portugal is required.

European Union credit institutions – branch in Portugal

Before a branch can be established in Portugal, Banco de Portugal must receive a detailed notification from the home member state’s competent authority.

Once this notification is received, Banco de Portugal has two months to establish the supervision framework for the branch in relevant areas. After this period, Banco de Portugal will notify the credit institution that it can proceed with the establishment of its branch, specifying any conditions for its operation in Portugal required by public interest.

If no notification is received within two months, the branch can be established and may start its activities after completing the relevant registration process.

Portuguese credit institutions – passport

A Portuguese credit institution that intends to start operations in another member state of the European Union must previously notify Banco de Portugal, detailing the activities it plans to carry out in that member state.

Banco de Portugal will then notify the host member state’s competent authority within one month, certifying that the proposed operations/activities fall within the scope of the credit institution’s authorisation in Portugal.

Qualifying Holding

Under the Legal Framework of Credit Institutions and Financial Companies, a qualifying holding is a direct or indirect holding: (i) representing a percentage of not less than 10% of the share capital or voting rights of the institution in question; or (ii) for any reason, allowing for the exercise of significant influence over the management of the institution.

An assessment of the good repute of the owners or potential owners of qualifying holdings is required and is carried out by the ECB or, if the institutions in question are not part of the Single Supervisory Mechanism, by Banco de Portugal.

Notification

The relevant thresholds are: (i) 10%; (ii) 20%; (iii) one third; and (iv) 50%, in relation to a credit institution’s capital or voting rights.

Any natural or legal person that intends to acquire, increase, reduce or dispose of a qualifying holding is required to provide prior notice to Banco de Portugal. This notification is required when the percentage of such qualifying holding reaches, exceeds or falls below the above thresholds. 

This notification to Banco de Portugal must be made in Portuguese or in English, physically or via e-mail and no fee is due as a result thereof.

Acquisition or increase of a qualifying holding

In case of a planned acquisition or increase of a qualifying holding, the process begins with the submission of a notification and the required documents to Banco de Portugal, which then forwards this submission to the ECB. Both entities jointly review the proposal and may request more information, if necessary. Banco de Portugal subsequently drafts a decision on the acquisition or increase of a qualifying holding, which is sent to the ECB for review and for a final decision to be taken. This final decision is then communicated back to Banco de Portugal and the applicant, within 60 working days after proper submission of the notification.

Reduction or disposal of a qualifying holding

In the case of a planned reduction or disposal of a qualifying holding, a notification with all the required elements must be submitted to Banco de Portugal. Banco de Portugal then reviews the proposal to assess if the remaining holding is considered a qualifying holding. Additional information may be requested during this process. Banco de Portugal must decide on the holding status within 30 days (business days for electronic money institutions or calendar days for credit institutions and financial companies) after proper submission of the notification. Banco de Portugal will specify if the holding still qualifies, if it falls below 10%, or will confirm receipt and completeness of the submission, if the holding is fully disposed of or remains above 10%.

Ongoing Requirements

Any holders of qualifying holdings shall notify Banco de Portugal of any changes to the information previously provided to the regulator and of any increase, reduction, or disposal of a qualifying holding in accordance with the procedures outlined above.

Legal Requirements

In Portugal, the main rules applicable to corporate governance are covered by: (i) the Portuguese Companies Code (Decree-Law No 262/86, of 2 September); and (ii) the Legal Framework of Credit Institutions and Financial Companies.

Portuguese credit institutions always take the form of a public limited company (sociedade anónima). They must have their head office and place of effective management in Portugal, and must have in place robust governance arrangements, including a clear organisational structure with well-defined, transparent, and consistent lines of responsibility, and effective processes to identify, manage, monitor, and report risks. Credit institutions also need to be equipped with adequate internal control mechanisms, including sound administrative and accounting procedures, gender-neutral remuneration policies and practices that promote and are consistent with sound and prudent risk management, and management and supervisory bodies composed of members whose reputation, professional qualifications, independence, and availability ensure the sound and prudent management of the credit institution.

In terms of corporate bodies, credit institutions in Portugal can be organised as follows:

• board of directors and supervisory board;
• board of directors, including a supervisory board, and statutory auditor; and
• executive board of directors, general and supervisory Board, and statutory auditor.

Diversity in Management and Supervisory Bodies

Portuguese credit institutions must implement internal policies for the selection and evaluation of management and supervisory body members that promote diversity in the qualifications and skills necessary for these roles, setting objectives for the balanced representation of men and women and designing a strategy aimed at increasing the number of individuals from the underrepresented gender.

Soft Law and Industry Initiatives

The European Banking Authority’s Guidelines of 2 July 2021 on internal governance serve as the primary reference for the internal governance structure of credit institutions. These guidelines cover a wide range of topics to ensure the robust internal governance of credit institutions.

Credit institutions that are members of the Portuguese Banking Association (Associação Portuguesa de Bancos) must comply with the Association’s Code of Conduct, which establishes rules of conduct for banks in Portugal, particularly regarding their professional ethics standards.

Additionally, many credit institutions in Portugal are also members of the Portuguese Institute of Corporate Governance (Instituto Português de Corporate Governance – IPCG). This Institute has a Corporate Governance Code that sets forth rules regarding: (i) a company’s relationship with its shareholders, stakeholders, and the community in general; (ii) the composition and functioning of the company’s corporate bodies; (iii) shareholders and general meetings; (iv) management; (v) performance evaluation, remuneration, and appointments; (vi) internal control; and (vii) information and statutory audit of accounts.

Board members (and supervisory board members) are selected and appointed by the general meeting of shareholders in accordance with the Portuguese Companies Code.

Potential members of the management and supervisory bodies of credit institutions are subject to a suitability assessment prior to the exercise of their duties and throughout their entire mandate. They must always meet the requirements of suitability, professional qualification, independence, and availability. The start of their functions is also subject to prior authorisation from Banco de Portugal.

Once authorisation from Banco de Portugal has been obtained, the registration of the members of the management and supervisory bodies must be requested. This request must indicate the starting date of their functions and, in cases requiring prior authorisation, be accompanied by a copy of the minutes with the resolution appointing them.

Positions which, despite not being part of the management or supervisory bodies, entail the exercise of functions with significant influence over the management of a credit institution (namely, those responsible for the functions of compliance, internal audit, control, and risk management) are also subject to the suitability assessment mentioned above.

In this regard, the European Banking Authority and the European Securities and Markets Authority’s Guidelines on the assessment of the suitability of members of the management body and key function holders, of 2 July 2021, provide important information on the suitability assessment. Banco de Portugal adopted these Guidelines on 29 November 2021, through its Circular Letter No CC/2021/00000058.

Credit institutions define and implement remuneration practices based on sound and prudent remuneration policies for all their employees, consistent with the institution’s risk profile and risk tolerance. The remuneration policy covers at least those employees whose professional activities have a significant impact on the credit institution’s risk profile, including:

• members of the management and supervisory bodies;
• senior management;
• heads of significant business units;
• individuals responsible for internal control functions; and
• employees who work in a significant business unit and whose activities, due to their nature, have a significant impact on the risk profile of that business unit, who earned, in the previous year, a remuneration equal to or greater than EUR500,000 and equal to or greater than the average remuneration given to the members of the management and supervisory bodies and senior management of the institution.

Credit institutions’ remuneration policies must follow certain key principles. These policies should be proportional, taking into account the size and activities of the institution, and should clearly differentiate between fixed and variable remuneration, ensuring the variable part does not exceed the fixed amount. They must also be gender-neutral and uphold the independence of employees in internal control functions, linking their pay to the achievement of specific objectives.

Additionally, at least half of the variable remuneration, including deferred amounts, should consist of financial instruments (Banco de Portugal may impose restrictions on the types and characteristics of such instruments), and the entire variable component must be subject to malus and claw-back mechanisms. Guaranteed variable remuneration is only allowed in the first year for new hires, and only if there is a strong capital base. The remuneration policy should be published on the institution’s website to ensure transparency. Finally, the management body or remuneration committee should submit the remuneration policy for approval by the management and supervisory bodies at the general meeting of each year.

Credit institutions must also establish a remuneration and performance evaluation policy for individuals who have direct contact with bank customers when marketing deposits and credit products. This policy will also apply to individuals who are directly or indirectly involved in the management or supervision of those with direct customer contact.

This remuneration and performance evaluation policy must not impair individuals’ ability to act in the best interests of the customers. In particular, it should ensure that remuneration measures, sales targets, or other goals do not encourage these individuals to prioritise their own interests or the interests of the credit institution over the interests of their customers. The policy must be assessed at least annually, with the adoption of any measures considered necessary to ensure that it upholds the rights and interests of the customers and does not create any incentives that could harm those rights and interests.

Finally, when drafting and implementing their remuneration policies, credit institutions must consider the European Banking Authority’s Guidelines on sound remuneration policies under Directive 2013/36/EU of 2 July 2021. Banco de Portugal adopted these Guidelines on 21 November 2021, through its Circular Letter No CC/2021/00000056. In addition, credit institutions in Portugal that are members of the Portuguese Institute of Corporate Governance must consider the provisions of the Corporate Governance Code.

Under the Portuguese Anti-Money Laundering and Counter-Terrorist Financing Law, credit institutions and financial companies, as financial entities, are considered obliged entities, subject to the supervision of Banco de Portugal.

In this context, the board member responsible for these functions and the person in charge of the anti-money laundering and counter-terrorist financing compliance (known as the Compliance Officer) play fundamental roles.

Consequently, financial entities must comply with several preventive obligations, such as:

• obligation of control;
• obligation of identification and diligence;
• obligation of reporting;
• obligation of abstention;
• obligation of refusal;
• obligation of record-keeping;
• obligation of examination;
• obligation of co-operation;
• obligation of non-disclosure; and
• obligation of training.

Among these, the authors highlight the following two: (i) identification and diligence; and (ii) reporting.

The first obligation encompasses the know your customer (KYC) process, under which obliged entities are required to identify their customer as well as the beneficial owner when: (i) establishing business relationships; (ii) conducting occasional transactions, regardless of whether the transaction is carried out through a single operation or several operations that appear to be related, amounting to EUR15,000 or more, or constituting a transfer of funds or a transaction involving virtual assets, whenever the amount exceeds EUR1,000; (iii) there is a suspicion that the operations, regardless of their value and any exception or threshold, may be related to money laundering or terrorist financing; and (iv) there are doubts about the accuracy or adequacy of previously obtained customer identification data.

The measures, information, and documentation requested will always depend on an anti-money laundering and counter-terrorist financing risk analysis, with the possibility of applying simplified or enhanced measures. The customer’s profile should be assessed, specifically considering whether they come from a sanctioned country, are a politically exposed person (PEP), or are individuals closely associated with a PEP.

The obligation of reporting requires obliged entities to immediately inform, on their own initiative, the Central Department of Investigation and Criminal Action of the Attorney General’s Office (Departamento Central de Investigação e Ação Penal – DCIAP) and the Financial Intelligence Unit whenever they know, suspect, or have reasonable grounds to suspect that certain funds or other assets, regardless of the amount or value involved, originate from criminal activities or are related to terrorist financing.

Obliged entities shall implement internal organisational structures and procedures informed by risk assessments, particularly regarding exposure to money laundering risks based on the services offered and the origin or destination country of the funds.

In this respect, obliged entities must observe Banco de Portugal Notice No 1/2022, of 6 June, and Notice No 1/2023, of 24 January (the latter regarding virtual assets), along with the European Banking Authority’s Guidelines under Articles 17 and 18(4) of Directive (EU) 2015/849 on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions, repealing and replacing Guidelines JC/2017/37 of 1 March 2021, and the Financial Action Task Force Recommendations, last updated in November 2023.

The Legal Framework of Credit Institutions and Financial Companies establishes the legal rules applicable to the Portuguese Deposit Guarantee Scheme (Fundo de Garantia de Depósitos).

The Portuguese Deposit Guarantee Scheme is a legal entity of public law, endowed with administrative and financial autonomy, and with its own assets. Its purpose is to ensure the reimbursement of deposits made into participating credit institutions. This is only possible through its financial resources (in addition to complementary financial resources), which are made up of: (i) initial contributions from participating credit institutions; (ii) periodic contributions from participating credit institutions; (iii) income from the application of resources; (iv) donations; and (v) any other revenues, income or amounts arising from a credit institution’s activity or assigned to it by law or contract, including the proceeds of fines imposed on credit institutions.

The Portuguese Deposit Guarantee Scheme is managed by a steering committee composed of three members. The chairperson is a member of the Board of Directors of Banco de Portugal, designated by it. The second member is appointed by and in representation of the Ministry of Finance. The third member is designated by the association representing, in Portugal, the participating credit institutions that collectively hold the largest volume of guaranteed deposits.

The following entities are mandatory participants in the Portuguese Deposit Guarantee Scheme: (i) credit institutions headquartered in Portugal that are authorised to receive deposits; and (ii) credit institutions headquartered in countries that are not members of the European Union, with respect to deposits collected by their branches in Portugal, unless these deposits are covered by a guarantee system in their country of origin which Banco de Portugal considers equivalent to the Portuguese Deposit Guarantee Scheme, particularly regarding the scope of coverage and the guarantee limit, and without prejudice to any existing bilateral agreements on the matter.

The Portuguese Deposit Guarantee Scheme ensures the reimbursement of: (i) deposits made in Portugal or in other member states of the European Union with credit institutions headquartered in Portugal; and (ii) deposits made in Portugal with branches of credit institutions headquartered in countries that are not members of the European Union, regarding the deposits collected by their branches in Portugal. The maximum limit is EUR100,000 per credit institution, in relation to the overall balance in cash of each deposit holder.

Finally, the Portuguese Deposit Guarantee Scheme does not guarantee the reimbursement of: (i) deposits made in the name and on behalf of credit institutions, investment firms, financial institutions, insurance and reinsurance companies, collective investment undertakings, pension funds, entities of the national and foreign public administrative sector, and supranational or international organisations, with the exception of deposits from pension funds whose members are small or medium-sized enterprises, and deposits from local authorities with an annual budget equal to or less than EUR500,000; (ii) deposits resulting from operations for which a final criminal conviction for money laundering has been handed down; (iii) deposits whose holder has not been identified in accordance with the Portuguese Anti-Money Laundering and Counter-Terrorist Financing Law, as of the date on which the unavailability of the deposits is determined; and (iv) deposits of persons and entities that, in the two years preceding the date on which the unavailability of deposits is determined or a resolution measure has been adopted, have had a direct or indirect holding equal to or greater than 2% of the share capital of the credit institution in question or have been members of its management bodies, unless it is demonstrated that they were not, by action or omission, the cause of the financial difficulties faced by the credit institution and that they did not contribute, by action or omission, to the aggravation of such situation.

Legal Regime

The principal legislation on capital, liquidity, and related risk control requirements is the Legal Framework of Credit Institutions and Financial Companies (which implemented in Portugal the Capital Requirements Directive IV (CRD IV) – Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, and the Capital Requirements Regulation (CRR) – Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms).

The rules provided for in CRR and CRD IV represent the adoption of Basel III standards, which were established to improve the banking sector’s ability to withstand shocks arising from adverse economic and financial scenarios.

There is a general principle that credit institutions must manage their available funds in a manner that ensures adequate levels of liquidity and solvency, at all times.

Initial Share Capital

According to Executive Order No 95/94, of 9 February 1994, the following credit institutions and financial companies must have a share capital of at least the amounts indicated below.

• Banks and savings banks: EUR17.5 million.
• Mutual agricultural credit banks: EUR5 million or EUR7.5 million, depending on whether or not they are part of the integrated mutual agricultural credit system.
• Central agricultural credit banks: EUR17.5 million.
• Investment companies: EUR5 million.
• Leasing companies: EUR3 million if their sole business is movable property leasing, or EUR5 million in all other cases.
• Factoring companies: EUR1 million.
• Financial brokerage companies: EUR3.5 million.
• Brokerage firms: EUR350,000.
• Money market or currency market brokers: EUR50,000 or EUR500,000, depending on whether they operate exclusively in the money market or in both markets simultaneously.
• Asset management companies: EUR250,000.
• Regional development companies: EUR3 million.
• Group purchasing management companies: EUR500,000 or EUR250,000, depending on whether they manage groups constituted for the acquisition of real estate.
• Currency exchange agencies: EUR100,000.
• Mutual guarantee companies: EUR2.5 million.
• Microcredit financial companies: EUR1 million.
• Financial credit institutions: EUR10 million.
• Financial credit companies: EUR7.5 million.
• Attached savings banks: EUR1 million.

Risk Management Rules

Credit institutions establish a risk management function that is independent of the business lines and is provided with adequate resources. This function is responsible for: (i) ensuring that all material risks of the credit institution are properly identified, assessed, and reported; (ii) participating in the definition of the credit institution’s risk strategy; and (iii) participating in decisions related to the management of material risks.

The risk management, compliance, and internal audit functions are established as autonomous and independent from each other. The board of directors ensures that the risk management function has a comprehensive view of all the risks to which the credit institution is currently exposed and may be exposed in the future.

Capital Requirements

The CRR addresses capital requirements, such as Common Equity Tier 1 (CET1), which is a part of Tier 1 capital and involves shares, capital instruments ranking below all other claims in an insolvency, share premium accounts, retained earnings, other reserves, and funds designated for general banking risks. In addition to CET1, Tier 1 capital also encompasses Additional Tier 1 (AT1) capital, which includes capital instruments subordinated to Tier 2 instruments in an insolvency, along with their related share premium accounts. In contrast, Tier 2 capital is composed of subordinated instruments and associated share premium accounts, which rank below CET1 in priority.

In quantitative terms, credit institutions must ensure that they maintain at all times the own funds required under the CRR, namely: (i) CET1 – capital ratio of 4.5%; (ii) Tier 1 – capital ratio of 6%; (iii) total capital ratio – 8%; and (iv) leverage ratio – 3%.

According to the Legal Framework of Credit Institutions and Financial Companies, credit institutions must maintain, in addition to the 4.5% CET1, (i) a capital conservation buffer equal to 2.5% of the risk-weighted assets (RWA, as defined in the CRR); and (ii) a countercyclical capital buffer of between 0% and 2.5% of the RWA in Portugal (in increments of 0.25% or multiples thereof). Banco de Portugal has already announced that it intends to set the percentage of the countercyclical capital reserve at 0.75% of the total amount of the national banking sector’s credit exposures to the non-financial private sector weighted by risk.

Global Systemically Important Institutions (G-SIIs) must maintain, on a consolidated basis, a G-SII buffer composed of CET1 capital corresponding to the specific subcategory it is assigned to, as follows: (i) in the lowest subcategory, a buffer of 1% of the RWA is required; (ii) in the subsequent subcategories, the required capital buffer for each subcategory increases in increments of at least 0.5% of the RWA. Currently, there are no G-SIIs in Portugal and, therefore, this is not applicable. In turn, Other Systemically Important Institutions (O-SIIs) must maintain, on a consolidated, sub-consolidated, or individual basis, as applicable, an O-SII buffer composed of CET1 capital of up to 3% of the RWA, taking into account the criteria for identifying O-SIIs. As from 1 October 2024, a sectoral systemic risk buffer of 4% is applicable, as determined by Banco de Portugal. This buffer is applicable to institutions using the Internal Ratings Based (IRB) approach, based on the RWA of the residential mortgage portfolio secured by properties located in Portugal.

Liquidity Requirements

Under Commission Delegated Regulation (EU) 2015/61 of 10 October 2015 to supplement Regulation (EU) No 575/2013 of the European Parliament and the Council with regard to liquidity coverage requirement for credit institutions, a liquidity coverage ratio of at least 100% must be maintained by credit institutions. In this context, liquidity inflows and liquidity outflows shall be assessed over a 30 calendar-day stress period.

The liquidity coverage ratio shall be reported to Banco de Portugal by the credit institution in question.

The Legal Framework of Credit Institutions and Financial Companies, which implemented the Bank Recovery and Resolution Directive (BRRD) – Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms, which largely adopts the FSB Key Attributes of Effective Resolution Regime, establishes four resolution tools that can be applied by Banco de Portugal:

• sale, in part or in whole, of the business;
• bridge, in part or in whole, of the credit institution;
• asset separation, in part or in whole; and
• bail-in.

Firstly, in case of a sale of the business, Banco de Portugal may determine the partial or total sale of the rights and obligations of a credit institution under resolution, including its assets, liabilities, off-balance sheet items, and managed assets, as well as the ownership of shares or other securities representing its capital stock. The referred sale is conducted on commercial terms, considering the specific circumstances of the case, and the evaluation performed by an independent entity at the expense of the credit institution under resolution. This evaluation, to be carried out within the timeframe set by Banco de Portugal, must fairly, prudently, and realistically assess the credit institution’s assets, liabilities, and off-balance sheet items, taking into account European Union principles, rules, and guidelines on state aid.

Secondly, Banco de Portugal may determine the partial or total transfer of the rights and obligations of a credit institution, including its assets, liabilities, off-balance sheet items, and managed assets, as well as the transfer of ownership of shares or other securities representing its capital stock, to bridge institutions established for this purpose, with the aim of facilitating their subsequent sale. In this case, a bridge institution must be established by Banco de Portugal, with its share capital fully or partially subscribed and paid by the Resolution Fund (Fundo de Resolução) using its own funds.

Thirdly, Banco de Portugal may order the transfer of the rights and obligations of a credit institution or a bridge institution, including its assets, liabilities, off-balance sheet items, and managed assets, to asset management vehicles established for this purpose, with the goal of maximising their value for subsequent sale or liquidation. Additionally, the transfer of the rights and obligations of two or more credit institutions within the same group to asset management vehicles may be mandated. These vehicles are created to receive and manage all or part of the rights and obligations of credit institutions under resolution or a bridge institution. Similarly to bridge institutions, the share capital of the asset management vehicle is fully or partially subscribed and paid by the Resolution Fund using its own funds.

Fourthly, Banco de Portugal may mandate the application of the internal recapitalisation measure to strengthen the own funds of a credit institution to the extent necessary to enable it to meet the requirements for maintaining its authorisation to operate and to obtain autonomous and sustainable financing from the financial markets.

• This is applicable in cases where there is a reasonable prospect that the measure, along with other relevant measures, will achieve the objectives set out in the law and restore the long-term financial stability and viability of the credit institution. The following powers may be applied: (i) partial or total reduction of the nominal value of the liabilities of the credit institution under resolution that do not arise from ownership of own funds instruments and that are included within the scope of the internal recapitalisation measure; and (ii) increase in the capital of the credit institution under resolution or its parent company by partially or fully converting the liabilities included within the scope of the internal recapitalisation measure into common shares or securities representing the capital of the credit institution under resolution or its parent company.
• Additionally, based on the evaluation carried out by an independent entity, the following is determined in aggregate: (i) the amount of reduction in the nominal value of the liabilities included within the scope of the internal recapitalisation measure to ensure that the own funds of the credit institution under resolution are zero; and (ii) the amount of conversion of the liabilities included within the scope of the internal recapitalisation measure into capital, through the issuance of common shares or securities representing the capital, to achieve a Common Equity Tier 1 (CET1) ratio of the credit institution under resolution or the bridge institution that allows it to maintain its authorisation to operate for at least one year and to obtain autonomous and sustainable financing from the financial markets.
• Lastly, Banco de Portugal applies the internal recapitalisation measure in accordance with the hierarchy of claims in insolvency. The nominal value of a class of liabilities cannot be reduced, nor can a class of liabilities be converted into capital, until those powers have been exercised in relation to the hierarchically lower classes of liabilities, as per that hierarchy.
• With the implementation of this measure, the management body of the credit institution under resolution must prepare and submit a business reorganisation plan to Banco de Portugal within 30 days of the measure’s application. This plan should include the following elements: (i) a detailed diagnosis of the factors, circumstances, and issues that led the credit institution under resolution to the risk or situation of insolvency; (ii) a description of the measures aimed at restoring the long-term viability of the credit institution under resolution, or of part of its activities, within an appropriate timeframe, which may include reorganising its activities; introducing changes to its operational systems and internal infrastructure; cessation of loss-making activities; restructuring existing activities that can be made competitive; and the disposal of assets or business lines; and (iii) the timeline for implementing these measures.

Deposits in Case of an Insolvency

The general credit privilege applies to most deposits (with a few exceptions), placing it above unsecured senior creditors of a credit institution.

Environmental, social and corporate governance (ESG) aspects are mainly regulated by European legislation and by soft law instruments. At present, there is a very board array of ESG legislation applicable to credit institutions.

In 2024, we have witnessed a crucial legislative change in the banking sector with the introduction of Regulation (EU) 2024/1623 of the European Parliament and of the Council of 31 May 2024, amending Regulation (EU) No 575/2013, regarding requirements for credit risk, credit valuation adjustment risk, operational risk, market risk, and the output floor. This Regulation, which will be applicable from 1 January 2025, will amend Article 449a of the CRR. Consequently, all institutions will be required to disclose information on ESG-related risks, distinguishing between environmental, social, and governance risks, as well as physical and transition risks with respect to environmental risks. Previously, this requirement was only applicable to large institutions that had issued securities admitted to trading on a regulated market of any EU member state. Portuguese credit institutions are already adapting internally to be prepared for the implementation of this new obligation.

The requirements for climate risk management in banks are mainly derived from the ECB’s Guide on climate-related and environmental risks, published in November 2020. Although this Guide is a soft law instrument, it outlines the ECB’s expectations (which are normally adopted by Banco de Portugal) on how banks should effectively manage climate risks within the existing prudential framework.

The European Banking Authority issued mandatory standards on Pillar 3 ESG risk disclosures, particularly the Green Asset Ratio (GAR), on 1 March 2021. The GAR measures the percentage of environmentally sustainable assets in relation to total assets. The numerator shows the proportion of assets invested in sustainable economic activities, while the denominator encompasses the institution’s total assets, loans, bonds and equities, collateral, and other balance sheet items. In this context, Commission Implementing Regulation (EU) 2022/2453 of 30 November 2022, which amended Commission Implementing Regulation (EU) 2021/637 of 15 March 2021, establishes important guidelines on how banks are required to disclose ESG-related information.

Credit institutions must also comply with the Taxonomy Regulation (Regulation (EU) 2020/852 of the European Parliament and of the Council of 18 June 2020 on the establishment of a framework to facilitate sustainable investment) and its delegated acts. This Regulation establishes, among others, the criteria for determining whether an economic activity qualifies as environmentally sustainable for the purposes of establishing the degree to which an investment is environmentally sustainable. Consequently, it has been observed in the Portuguese market that some Portuguese banks now provide eco-friendly loan options through their sustainable finance programmes, with favourable terms for borrowers, but which also include specific restrictions on how the funds can be used and certain requirements applicable to the borrowers’ activities.

The Sustainable Finance Disclosure Regulation (SFDR – Regulation (EU) 2019/2088 of the European Parliament and of the Council of 27 November 2019 on sustainability‐related disclosures in the financial services sector) is applicable to credit institutions providing portfolio management services (not to all credit institutions), establishing ESG-related disclosure obligations. In contrast to the Taxonomy Regulation, which focuses solely on environmental issues, the SFDR also covers social aspects.

The Corporate Sustainability Reporting Directive (CSRD – Directive (EU) 2022/2464 of the European Parliament and of the Council of 14 December 2022), which replaced the Non-Financial Reporting Directive, imposes mandatory reporting obligations on around 50,000 companies, including both EU and non-EU companies that meet the specified employee and annual turnover thresholds. The first reporting period will commence in 2025, covering information from the 2024 financial year. Its implementation in Portugal is still pending.

Finally, the authors highlight again the Corporate Governance Code of the Portuguese Institute of Corporate Governance and its incorporation and adaptation to the CSRD, which includes an article dedicated to stakeholders and sustainability. This emphasises the growing importance of sustainability matters, aligning with frameworks such as the 2023 G20/OECD Principles of Corporate Governance.

The Digital Operational Resilience Act (DORA – Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector) represents an important regulation for Portuguese credit institutions since it requires the adaptation of the security of their network and information systems supporting business processes.

DORA entered into force in January 2023 and will be applicable from 17 January 2025. The requirements set forth under the six pillars of DORA are: (i) organisational governance; (ii) management of information and communication technology (ICT) risks; (iii) handling of ICT incidents; (iv) resilience testing; (v) managing risks associated with third-party ICT providers; and (vi) sharing of information. Therefore, credit institutions are required to:

• establish internal governance and control systems to effectively and prudently manage all ICT risks. This includes creating monitoring roles for arrangements with third-party ICT service providers. Additionally, they must redefine the responsibilities of their management bodies to ensure they are accountable for defining, approving, and overseeing ICT risk management frameworks;
• develop a robust ICT risk management framework, including a digital resilience strategy, tailored to their specific needs, size, and complexity (which includes creating strategies, policies, procedures, protocols, and tools in line with DORA requirements, maintaining high standards of data security, confidentiality, and integrity). The disclosure of ICT incidents or vulnerabilities to relevant stakeholders is also required, as is the separation of ICT management, control, and internal audit functions, management of cyber threats, detection of abnormal activities, establishment of continuity and backup policies, performance of post-incident reviews, and guaranteeing adequate staffing and monitoring;
• implement a process for handling ICT-related incidents, including the detection, management, monitoring, follow up, and reporting of these incidents, classifying them based on specific criteria. Under DORA, any major ICT incidents must be reported to the appropriate regulator within specified timeframes and conditions. Additionally, if these incidents affect or could affect the financial interests of service users and clients, they must be informed of the incident and the measures taken to mitigate any negative effects;
• develop a digital operational resilience testing programme that follows a risk-based approach, including appropriate testing and vulnerability assessments;
• integrate third-party ICT risk into their ICT risk management framework, which includes: (i) ensuring compliance with DORA for third-party ICT services; (ii) developing and updating a third-party ICT risk strategy; (iii) formalising relationships through detailed contracts; (iv) maintaining a register of all ICT service contracts; (v) annually reporting new ICT arrangements to the authorities; and (vi) ensuring high security standards, auditing providers, and terminating contracts if necessary; and
• collaborate with other entities, sharing cyber threat information and intelligence with each other to enhance digital operational resilience, provided this occurs within a trusted community and under arrangements that safeguard the sensitive nature of this information.

Introduction

According to the European Commission (in its In-Depth Review 2024 Portugal of April 2024), “Portuguese banks improved their resilience in 2023 as higher net interest income boosted their profitability, without materially impacting their asset quality. Banks’ profit margins increased substantially over 2023 as the large share of variable rate loans yielded higher returns on the back of higher Euribor and key ECB interest rates, while deposit costs remained moderate. These further improved banks’ return on equity, to 10.6% in the first three quarters of 2023, the highest level since the financial crisis and above the euro area average. Portuguese banks used part of these profits to strengthen their capital positions, increasing their CET1 capital ratio by 104 basis points over the first three quarters of 2023 to 16.4%”. This is positive news, and the Portuguese economy (and banking sector) is expected to continue growing.

ESG Regulatory Development

It is expected that the Taxonomy Regulation will eventually cover social matters, as the Sustainable Finance Disclosure Regulation already does.

In addition, as referred above, the “new” Article 449a of the Capital Requirements Regulation will be applicable from 1 January 2025 and all Portuguese credit institutions will be required to disclose information on ESG-related risks, distinguishing between environmental, social, and governance risks, as well as physical and transition risks with respect to environmental risks.

The Corporate Sustainability Reporting Directive will also be transposed to the Portuguese legal order and in 2025 credit institutions will need to prepare a report covering information from the 2024 financial year.

Digital Operational Resilience Act (DORA)

DORA will be applicable from 17 January 2025 and Portuguese credit institutions will need to adapt to its requirements.

Capital Requirements Regulation (CRR) III and Capital Requirements Directive (CRV) VI

CRR III and CRD VI introduce significant changes with a view to implementing the remaining elements of the Basel III regulatory reforms, which the European Union (EU) has mostly adopted. Key aspects include a new regulatory framework for non-EU banks to harmonise EU supervision, requirements for managing ESG-related risks, revised methods for calculating risk-weighted assets, with an emphasis on standardised calculations, and the introduction of an “output floor” to ensure minimum capital requirements for banks using internal models.

Moreover, they mandate more detailed fit and proper tests for senior bank managers, ensuring harmonised vetting processes before they assume their roles, and extend the supervisory powers of competent authorities. This includes the oversight of credit institution acquisitions, significant asset or liability transfers, and mergers or divisions. These initiatives aim to align bank risk management and capital requirements with broader sustainability and regulatory goals within the EU.

Anti-Money Laundering and Counter-Terrorist Financing: AMLD6 and AML Regulation

Directive (EU) 2024/1640 of the European Parliament and of the Council of 31 May 2024 on the mechanisms to be put in place by member states for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLD6) establishes guidelines requiring national governments to implement measures against money laundering and terrorist financing. This Directive will need to be implemented in Portugal.

Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AML Regulation) establishes rules which include measures for obliged entities to prevent money laundering and terrorist financing. It also outlines transparency requirements regarding beneficial ownership for legal entities, express trusts, and similar legal arrangements, and implements measures to curb the misuse of anonymous instruments. This Regulation will apply from 10 July 2027, except for the provisions regarding football clubs and agents as obliged entities, which will not be applicable until 10 July 2029.

Payment Services Developments: PSD3 and PSR

The Payment Services Directive (PSD3) and the Payment Services Regulation (PSR) are set to bring significant changes to the payments industry. PSD3 is designed to improve open banking and consumer protection by making payments more transparent, increasing market competition, and promoting innovation in digital payments.

Some of the key changes include enhanced security measures, to better protect online transactions from fraud, and expanded open banking practices, which require banks to share customer data more effectively with third-party providers. Additionally, there is a focus on transparency, mandating that banks clearly disclose their fees and terms so that consumers are better informed.

The PSR and PSD3 also emphasise the development of instant payments, the simplification of cross-border transactions, and the overall improvement of the digital payment infrastructure. These measures aim to help Portuguese credit institutions better adapt to the needs of tech-savvy consumers and businesses, thus ensuring they are well-prepared for the rapidly evolving financial landscape.

Markets in Crypto-Assets Regulation (MiCA)

MiCA will be applicable from 30 December 2024. In relation to the issuance, offer to the public, and admission to trading of crypto-assets or the provision of services related to crypto-assets, credit institutions shall observe the requirements established by MiCA, notably the required notification.

Retail Investment Package

As a result of its 2020 Capital Markets Union Action Plan, the European Commission adopted the Retail Investment Package on 24 May 2023, with the primary aim of protecting retail investors in the EU. This Package involves changes to, for example, MiFID II and the Packaged Retail and Insurance-based Investment Products Regulation (PRIIPs – Regulation (EU) No 1286/2014 of the European Parliament and of the Council of 26 November 2014 on key information documents for packaged retail and insurance-based investment products).

Developments in this regard are expected in 2025.

Non-performing Loans (NPLs)

Directive (EU) 2021/2167 of the European Parliament and of the Council of 24 November 2021 on credit servicers and credit purchasers is yet to be implemented in Portugal.

Banking Activity Code

The draft of the new Portuguese Banking Activity Code was released for public consultation by Banco de Portugal on 29 October 2020. Four years later, this legislation, intended to simplify and systematise the legal framework governing banking activities in Portugal (completely replacing the Legal Framework of Credit Institutions and Financial Companies), is yet to be approved. Banco de Portugal has urged the government to revisit this matter, but, as far as public knowledge is concerned, without success so far.

Governance and Internal Control Systems

On 14 November 2024, Banco de Portugal opened a public consultation for a draft amendment to Notice No 3/2020, which regulates government and internal control systems and sets the minimum standards for the organisational culture of entities under its supervision. Additionally, a draft amendment to Instruction No 18/2020 was also put forward, concerning reporting obligations related to conduct, organisational culture, and government and internal control systems.